Select your localized edition:

Close ×

More Ways to Connect

Discover one of our 28 local entrepreneurial communities »

Be the first to know as we launch in new countries and markets around the globe.

Interested in bringing MIT Technology Review to your local market?

MIT Technology ReviewMIT Technology Review - logo

 

Unsupported browser: Your browser does not meet modern web standards. See how it scores »

{ action.text }

The attackers spent $1,400 on the black market for the details of 14 known, but not patched, bugs in WebKit. They then devised a way to use them to gain full “root” access to a device and built a complete system that would use those powers to install a remote access tool, or RAT, app that they had seized from China-based hackers.

“Nation states like Russia and China are active in developing RATs, and if we can do [this] in a few weeks, they certainly can as well,” said Dmitri Alperovitch, CrowdStrike’s chief technology officer. The RAT in the demo was a conventional app with elevated privileges that could potentially be detected by security apps available for Android, he said, but given more time, it would be possible to use the same methodology to install very hard-to-detect “rootkit” software invisible to such tools.

Kurtz tried to end on something of a positive note, saying, “the sky’s not falling. These are very targeted attacks.”

Preventing attacks like the one demonstrated on stage requires more frequent updates to mobile operating systems, said Kurtz. However, doing that is far from easy, because wireless carriers, device manufacturers, and mobile operating system providers must all be involved. As a consequence, most mobile devices today receive updates very rarely. 

15 comments. Share your thoughts »

Tagged: Computing, security, geolocation, Android devices

Reprints and Permissions | Send feedback to the editor

From the Archives

Close

Introducing MIT Technology Review Insider.

Already a Magazine subscriber?

You're automatically an Insider. It's easy to activate or upgrade your account.

Activate Your Account

Become an Insider

It's the new way to subscribe. Get even more of the tech news, research, and discoveries you crave.

Sign Up

Learn More

Find out why MIT Technology Review Insider is for you and explore your options.

Show Me